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From: 

Sent: 12 February 2020 20:27 

To: SARguidance 

Subject: SARs Consultation - UCL MIRRA submission 
Attachments: UCL-MIRRAresponse-ICO-SARS-consultation-Feb2020.pdf 


External: This email originated outside the ICO. 

In response to the ICO's consultation on DPO guidance for subject access requests, the attached 
document is submitted by UCL’s MIRRA (Memory - Identity - Rights in Records - Access) research 
group. This work has been designed and delivered by academics and care leavers in conjunction with 
the Care Leavers Association. The study concluded that whilst there are good case studies of DPOs 
processing SARs for care leavers, there were many authorities with poor processes in place. Often the 
process of undertaking a SAR was extremely distressing for care leavers. 


In the light of this context, we conclude that the draft guidance is relatively clear for Data Protection 
Officers (DPOs) and to be welcomed. However, in its procedural tone, it misses an important 
component that prepares a DPO for properly performing the role - this is the impact on the individual 
of the decisions and processes a DPO makes. Even if this is a formal document, this nevertheless 
should be further stressed. We think the significance of this within this general document could be 
evidenced by a couple more case examples and an expanded discussion. We are happy to provide a 
case example. During the MIRRA project a film was made (available 

at https://www.youtube.com/watch?v=xs28tczL3yA) which does provide a strong case example as 
to why this matters; we would be happy for the ICO to embed the film on the ICO site and link to 
it. In addition, the MIRRA work can evidence some of the DPO decisions required when weighing 
rights. The ICO need to better empower DPOs in this context, so that they understand the choices to 
be made with clear examples. 


In addition, we would strongly stress that this guidance needs to be supplemented by more specific 
and detailed guides for particular groups of people who make SARs. We would like to see a 
supplementary guide for care leavers. There are estimated to be up to half a million people in the UK 
who are care leavers. In such cases the state carries parental responsibilities, which include 
documenting a child’s life. Often these records remain the only tool that a care leaver has to make 
sense of their life and identity. Case law has highlighted that as these records exist and are made with 
the focus as the child, wherever possible the whole set of information should be released. However, 
DPOs do often unnecessarily redact information and do not weight the process sufficiently in the 
favour of the child in care or care leaver. This is because the DPOs are naturally risk averse and it 
appears that redaction is the easiest choice to make. However, this is often not the correct choice. 
More detailed guidance in this domain would have a significant impact in empowering DPOs to make 
the right choices. We would state, that this particular Guidance as it stands, will not improve processes 
for this community. 


We hope that you will carefully consider our comments. We would be keen to work further with the 
ICO and are happy to offer any assistance with case examples for this particular document. 


Kind regards 


Kind regards 
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